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Abstract 

We examine the "Guessing Secrets" problem arising in internet 
routing, in which the goal is to discover two or more objects from a 
known finite set. We propose a quantum algorithm using 0(1) calls 
to an 0{logN) oracle. This improves upon the best known classi- 
cal result, which uses 0{logN) questions and requires an additional 
0{logN^) steps to produce the answer. In showing the possibilities of 
this algorithm, we extend the types of questions and function oracles 
that the Deutsch-Jozsa algorithm can be used to solve. 
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1 Introduction 



Inspired by challenges in internet routing [lOj, Chung, Graham, and Leighton 
proposed the "Guessing Secrets" problem IJ in which a set of k objects is to 
be reconstructed based on the answers to a set of questions. It is a property of 
the answer set as a whole that gives us information, suggesting that perhaps 
a quantum algorithm could efficiently solve this problem. We propose using 
the Deutsch-Jozsa algorithm. Bernstein and Vazirani jl] showed a problem 
that requires logN classical function calls but that is solved in one application 
of Deutsch-Jozsa; generalizations and other applications have followed [3 
ini E]- The present problem for two objects can be solved classically in 
0{logN + (logNY) steps PJ. In the quantum case, we can eliminate the 
logN^ term of the complexity. 

The next section gives necessary background on the classical problem. It 
is followed by the presentation and analysis of the quantum algorithm in the 
case k = 2. Finally, we present some explorations in a related problem with 
more objects. 

2 The problem for k = 2 and its classical ap- 
proaches 

The following summarizes the basic problem and approaches for k = 2 as 
presented by Chung, Graham, and Leighton [T]: 

We are given a finite set of objects Q, of size A^. An honest but possibly 
malicious adversary selects elements {Xi,X2} C Q. Our task is to deduce 
as much as possible about the Xj's by asking yes/no questions. A question 
is simply a map from Q to {0, 1}. For each question q, the adversary must 
respond with either q{Xi) or q{X2). Our goal is to construct a set of questions 
{qj} and an algorithm to use the responses to determine as much as possible 
about {Xi, X2}. 

Example: Suppose Q = {1,2,3,4}. The Adversary chooses {Xi,X2} = 
{1, 2}. If the question were "Is your object an odd number?" the Adversary 
could answer on behalf of 1 and say "Yes" or on behalf of 2 and say "No." 
On the other hand, if the question were "Is your object less than three?" the 
Adversary must answer "Yes," since that answer is true for both objects in 
the set. 
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There are inherent hmits on what we can be assured of finding out. We 
can represent the elements of Q as vertices of a graph; each question ehmi- 
nates some number of possible pairs of objects, which correspond to edges in 
the graph. If our graph contains two disjoint edges {Xi,X2) and (X3,X4), 
we can ask a question q such that q{Xi) = q{X2) ^ Qi^s) = ^'(-'^4)5 the 
response to which will eliminate one of the edges. There are only two types 
of graphs that contain no disjoint pairs of edges, a star and a triangle, and 
once we are in one of these configurations, the Adversary can prevent us from 
gaining any new information. A star, a set of edges all sharing a common 
vertex, indicates that we know one of the objects we seek but have limited 
information about the other; a triangle means that our two objects are con- 
tained in a set of 3, but we don't know which they are. The upshot is that 
the Adversary can limit our knowledge in this way no matter what questions 
we ask. So, our goal is reduced to arriving at a point of maximal knowledge 
as quickly as possible. 

Chung, Graham, and Leighton noted that the minimal size of the question 
set is OilogN) whether the questions depend on previous answers or not. As 
a result, we will use only non- adaptive algorithms, where the entire question 
set is submitted to the Adversary at once. It is then reasonable to define a 
vector A = {Ai, A2, . . . , Am), where m is the number of questions asked and 
Aq is the adversary's response to question q. 

Once we know the size of a minimal question set, the next goal is to create 
questions that allow efficient implementation and recovery of information 
about the {Xj}. One productive idea is to represent Q as 5", a binary n- 
vector space for n = \l0g2N] , and also to identify the questions q as elements 
of -B", defining q{X) = q ■ X, the inner product (mod 2) of q and X. 

Given a set of questions that generates maximal information, efficiently 
extracting this information from the responses is not easy. Both Tj and 
offer ways to do this, increasing the size of the question set by a constant 
factor to allow recovery in time polynomial in logN . In the quantum case, 
the recovery of information is fundamentally intertwined with the asking of 
the questions, so no distinction is made between them. 

In the classical algorithm, the number of questions is equal to the num- 
ber of calls to the adversary, and thus minimizing the size of the question 
set is paramount. In the quantum model, we can ask all the questions in 
superposition, so the number of calls to the adversary is the more important 
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measure of efficiency. We have chosen to use all of 5" for our question set, 
which, though much larger than the minimum necessary, has two distinct 
advantages. First, it exhibits a symmetry that we will take advantage of. 
Second, we can efficiently generate a superposition of questions by applying 
a Hadamard gate to each individual qubit; no multi-qubit operations are 
needed. And while the set of questions is big, the number of calls to the 
Adversary will be small. 

3 Quantum Procedure using Deutsch-Jozsa 
3.1 Quantum Reformulations 

In their paper, Chung, Graham, and Leighton describe their problem as a 
generalization of traditional "20 Questions", a game in which there is one 
unknown object X G fi: 

20 Questions 

Given an Adversary vector A such that Vg, Aq = q{X) for some fixed X; 
find X. 

We compare this to the parity problem of Bernstein and Vazirani |3] , in 
which the quantum oracle inputs q and returns the parity of the sum of a 
subset of the binary digits of q. This parity is exactly q ■ X (mod 2) for some 
X, so we can write: 

Parity Problem: 

Given a quantum oracle for a function /, such that Vg, f{q) = q-X for 
some fixed X; find X. 

Since we have defined our questions in terms of the dot product, it is 
clear that the parity problem is the quantum analogue of 20 Questions. In 
a similar way, we can formulate a quantum version of Chung, Graham, and 
Leighton's problem: 

Quantum Guessing Secrets: 

Given a quantum oracle for a function /, such that Vg, /(g) = g-Xi or /(g) = 
g ■ X2 for some fixed Xi, X2; find Xi and X2. 

In this formulation, we define a quantum oracle based on the function 
/(g) := Ag, where A is the vector of adversary responses described above. 
This oracle will be a unitary map that takes \q)\y) to \q)\yQ)Aq) with addition 
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taken modulo 2. (Here, \y) represents a single qubit, while |g) is an n-qubit 
binary string \q1q2 • . • g„) with q = X^ILi Q'iS""*). 

The Deutsch-Jozsa algorithm was designed to distinguish between con- 
stant and balanced functions. A more careful inspection of the measurement 
output shows that it can distinguish the N different functions fj G -B" de- 
fined by fj{X) = j ■ X |8j and thus solves the parity problem We see 
then that the Deutsch-Jozsa algorithm solves "20 Questions" in only one call 
to the oracle. This inspires us to apply it to Guessing Secrets. 

Much other work has been done to extend the classes of functions that 
this type of algorithm can distinguish El- In this paper we extend 
Deutsch-Jozsa in yet another direction by applying it to the guessing secrets 
problem. Terhal and Smolin jll] applied variations of Deutsch-Jozsa in order 
to recover an unknown object in a single query, but one oracle call will be 

f n\ 

insufficient for our purposes. There are I ^ I + triangles and maximal 

stars that our algorithm must distinguish, and Farhi, et al., have shown that 
such a quantum search must take at least 3 queries [7]. 

3.2 The Quantum Algorithm 

Proposition 1 With a single call to the Adversary oracle, the Deutsch-Jozsa 
algorithm outputs one of the desired objects with probability at least one half. 

Proof: The algorithm is as follows: 

• Step 1: Initialize n bits to |0) plus an extra bit to 

• Step 2: Apply a Hamamard gate to each of the first n bits, to get a 
uniform superposition of all questions q. Also apply a Hadamard gate 
to the final qubit to get an eigenstate of the NOT gate. 

• Step 3: Apply the Adversary oracle. 

• Step 4: Apply a Hadamard gate to each of the first n bits. 

• Step 5: Measure the first n bits in the computational basis. 
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Formally, the system evolves like this: 



q=0 

N-1 

q=0 
N-1 



j=o v2 
The coefficient of \j) is given by 



N-l 

What do we know about the coefficients of \Xi) and IX2) (denoted Cxj 
and Cxa)? For all g', /(g) — q - Xi or f{q) — q ■ X2, so there are only three 
types of questions q: 

• 1: q- Xi^ q- X2 BXid f{q) ^ q ■ Xi 

• 2: q ■ Xi ^ q ■ X2 and f{q) ^ q ■ X2 
. 3: g.Xi = g-X2 = /(g) 

Let Si be the number of questions of type i, for i = 1,2, 3. 

By the symmetry of B"-, for any distinct objects X,Y & fl, q ■ X = q ■ Y 
for exactly half the possible values of q. In particular S3 — N/2. This allows 
us to calculate the probability that we measure Xi or X2: 
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, . , , (2) 

This means that the output of our measurement is one of the desired 
states with probabihty at least |. QED 
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3.3 Finishing the Procedure 



For given e, choose values for m and d such that 



Probabihty ( Binomial ( m, 




m \ 



with d as small as possible for the selected m. Run the algorithm m times 
and let E be the number of outputs equal to either Xi or X2. Then 



Let F{X) = the number of times X appears as output in these m runs, for 
all X & Q. Then with probability 1 — e, 



There are two possible cases: 

• Case 1: There is no X e Q with F{X) > f - rf. Then with probability 
1 — e, {Xi, X2} is one of the edges (X', X"). The corresponding graph 

is not too complex, and complexity bounds depend only on e. We can 
then ask few questions sequentially of the oracle to reduce the graph 
to a triangle or star. 

• Case 2: There is a dominant X' with F{X') > ^ — d. Then all that 
can be said with probability 1 — e is that the set of possible edges forms 
a star and that X' is the center of it. This is entirely analogous to 
the classical case, in which our remaining uncertainty is determined 
by the number of points on the star. While the classical algorithm 
was a method of elimination, the quantum algorithm is a generator of 
outcomes; as such, it allows us to discover the center of the star quite 
quickly, even if it makes it harder to find all the possible second objects. 

Let X E Vt, X ^ {Xi,X2}. For every run of the algorithm, Cx^ > \Cx\ 
for i = 1,2. (The requirement that half the answers for X match those for 
Xi and X2 ensures that Cx can be neither too big nor too small.) So the 
expected value E[F{Xi)] > E[F{X)],i — 1, 2. This fact will remain true even 
if the Adversary changes the oracle between calls and so will be useful in any 
further statisical analysis of the outcomes. 





(3) 
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3.4 Examples 

• Full star: The Adversary answers every question for the same object 
(y q Aq = q-Xi). The corresponding graph is a star centered at Xi with 

— 1 points. The quantum algorithm outputs Xi with probability 1. 

• Triangle: The Adversary chooses a third object X* and answers for 
it whenever there is a choice. (If g • Xi q ■ X2, Ag = q ■ X*.) The 
corresponding graph is a triangle on Xi, X2, X* . Our algorithm will 
output Xi,X2,X*, or Xi ©X2 ©X*, each with probability ^. At most 
three additional questions will be needed to determine which 3 out of 
4 are desirable. 

• An intermediate case: For questions when q-Xi ^ 9 '-^2, the Adversary 
chooses q ■ Xi three-fourths of the time. The corresponding graph is 
either a star centered at Xi with only a few points or simply the edge 
(Xi,X2). The quantum algorithm outputs Xi with probability ^, X2 
with probability and a handful of others, each with probability < ^. 

4 Comparing Complexities of the Classical 
and Quantum Algorithms 

The classical case for k = 2 requires 0{logN) questions that are answered 
sequentially. In the quantum case, each run of the algorithm requires only one 
call to the oracle. Since we are directly comparing the quantum performance 
to the classical, one must ask whether our large question set makes the oracle 
exponentially more complex. The answer is No. If the Adversary wishes to 
effect a triangle or an {N — l)-pointed star, it is straightforward to write 
an oracle algorithm in 0{logN) steps to assign appropriate values for /(g). 
(More generally, a quantum adversary can force the guesser into a graph G 
with an 0{logN) oracle if and only if a classical adversary could force the 
guesser into G with any 0{logN) questions from the set 5".) 

Thus the questioning part of the algorithm takes 0{logN) steps in both 
cases. Classically, it is then necessary to extract information about {Xi, X2} 
from the questions' answers; the list decoding method in [2j accomplishes 
this in 0{{logN)^) steps. By contrast, the quantum algorithm simply runs 
0(1) times and the output is in an immediately useable form. The number 
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of runs (and calls to the oracle) is independent of the size of Q and depends 
only on the desired level of certainty. It is the avoidance of a complicated 
decoding stage that allows the quantum algorithm to perform faster than its 
classical analogue. 

5 What about k > 2? 

In the original paper, Chung, Graham, and Leighton begin with a more 
general problem in which the guesser tries to determine a set of k objects, 
with the promise that for all questions q, the Adversary's response Ag = q{Xi) 
for some i E {1,2, . . . k}. Both [T] and j2] observe that the situation gets much 
more complicated for k > 2, and the classical results in this case are far from 
complete or satisfying. For k = 2, there are 2 shapes for the final graph 
(star and triangle); for k = 3, there are 8 final hypergraph shapes, and any 
algorithm must be able to distinguish 0{N'^) of them According to [7], 
a quantum algorithm that can differentiate these requires at least 7 oracle 
calls. However, our present algorithm does not extend directly in the case of 
larger k. 

To see this, let A; = 3 and define the function by a "minority rule" (for 
fixed Xi, X2, Xs, fig) := q ■ X, © q ■ X2 © g ■ X3); then q ■ Xi = f{q) for 
exactly half the questions and = for i = 1,2, 3. The algorithm will 
never pick any of the correct objects! This sort of difficulty will persist for 
all higher values of k. 

It is possible to generalize the original problem differently by placing 
stronger restrictions on the function /. For example, suppose that when 
asked a question, the Adversary must respond on behalf of the majority of 
the Xi, X2, . . . , Xfc. This example is formalized below: 

Majority Problem 

Given a function / : 5" — > {0, 1} such that V g G B^, f{q) = q ■ X^ for 
at least half of the X, G {Xi, X2, . . . ,Xk}; determine {Xi, X2, . . . , Xk}. 

Using the Deutsch-Jozsa algorithm with the function oracle does solve 
this problem. As before, we define a run of the algorithm as successful if its 
output is one of the Xi. 
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Proposition 2 (i) If the Xi's are linearly independent as vectors in B^, 
the algorithm succeeds with probability > p^, where p^ > - if k is odd; 
Pk > \ if k is even; and as k ^ oo, Pk ^ ^■ 

(a) With no assumptions about the Xi 's and for k odd, P(success) > ^, and 
the order of this bound is strict. 

(Hi) In the case k = 3, the Deutsch-Jozsa algorithm solves the Majority 
Problem, producing one of the desired objects with probability > |. 

The issue of independence arises from tlie following: 

Symmetry Principle: 

For all linearly independent sets of vectors {Xi,X2, ■ ■ ■ ,Xk} C B" and 
V G -B^, the vector (g ■ Xi, q ■ X2, ■ ■ ■ ,q ■ Xk) = v for exactly 2""^^ questions 
q e 5". 

It is obviously a disadvantage to require independence for our result. On 
the other hand, most sets of vectors {Xi,X2, . . . are linearly indepen- 
dent in the following sense: If k vectors are chosen uniformly in S", a simple 
inductive argument shows that they are linearly independent with probability 
greater than 1 — 2'^~". 

Combinatorial Proof of Proposition O 

(i) For M C {1,2. . define 

{ liiieM 

Sm := {^ : f{q)=q-Xi} = M} 

Thus Sm counts the number of questions for which M is the set of X^ 
which agree with the function. 

In Step 4 of the algorithm, the coefficient of is where 

Mc{l,2,...,k} 

Observe that if |M| < | then Sm = by assumption, and if \M\ = | 
then J2i ^i,M = 0. This means that once we sum over i, we can restrict our 



10 



attention to subsets M with I Ml > 



2" 

k 



If the Xj's are hnearly independent and \M\ > |, then = 2 ^2^^ 
by the Symmetry Principle stated above, so 



N 
2fe-l 



« TV 
i=i i;|M|>| i;|M|>| 



For a given j, there are ^ j j subsets M of size j. For a fixed ^, we can 

then count how many M's contain i and how many do not. This is exactly 
the information encoded by ei^u' 

Summing over all J > | 

k N 

i=l 1=1 |M|>| 

N k-l \ 



kN / fc- 1 \ 
2fe-i I [Ml] _ 1 ) 



Dividing by yields 



(8) 
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The sum of the squares of the coefficients is minimized if they are all the 
same. 

P(success) = g > j =. (10) 

It is easy to check that P2 = ^ and = |; andp2m increases monotonically 
to I while P2m+i decreases monotonically to |. 

(ii) The assumption that k is odd implies that for all M C {1, 2, . . . , A;}, 
either \M\ < | and Sm = 0, or else (2|M| - A;) > 1. So for all M: 

{2\M\-k)SM>SM (11) 

Also, for any M, 

^e,,M = \M\ -{k- \M\) = 2\M\ - k (12) 

i 

By definition, J2m is the total number of questions, so 

k 

X^Cx, =E ^i,MSM = Y.i'^\M\-k)SM > E-^M = (13) 

i=l LM M M 



Dividing by N gives 



k r~i 

E— = 1 (14) 



The sum of the squares is minimized if each — ^ 



N k- 



P(success)^g(^) >.(-) (15) 

We cannot do significantly better than this bound, either. Let G be a 
subgroup of B" and let Xi, X2, . . . , be the nonzero elements of G. (So k 
is one less than a power of two; in particular, k is odd.) Then f(q) = if 
and only if g e G^, which implies that for all i e {1, 2, . . . , /c}: 

Cx,^f^.|G-|Vr^-|G-|U2(n)^2f^) (16) 



2 ' 7 V2 ' 7 " " \k + l 
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Dividing by and summing the squares, we get 

P(success) ^ ,17) 
This is O(^), so the bound above is more or less strict. 

(iii) It should be noted that the Majority Problem for k = 3 is equivalent to 
the earlier example of the triangle f Section l3.4|) . where it was stated without 
proof that Xi, X2, and X* would each appear with probability i. A complete 
proof follows immediately from the results (i) and (ii): 

Part (i) proved that = | if the {Xi} are independent. If they are 
dependent and all nonzero, then they are the nonzero vectors of a subgroup G 
as described in (ii) and P (success) = = |- Finally, if one of the vectors 

is zero, the vectors span a subgroup of dimension 2 and it is straightforward 
to show that each vector in this group will appear with probability ^. Thus 
in any case, the algorithm succeeds will probability > |. QED 

6 Conclusions 

The Deutsch-Jozsa algorithm was written to show the power of a quantum 
computer in solving an artificially created problem. In this paper, we ap- 
plied the same algorithm in a different way to an existing classical problem 
with active interest in combinatorics and computer science. This "Guessing 
Secrets" problem can solved classically in 0{logN + {logNY) steps while the 
quantum algorithm uses 0(1) calls to an 0{logN) oracle. The quantum algo- 
rithm achieves this higher efficiency by producing output in an immediately 
useable form. It is certainly worth considering what other sorts of problems 
might be addressed in a similar fashion. 
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